Crypto AML risk scoring, wallet screening, and transaction monitoring across BTC, EVM, Tron, Solana, and 500k+ tokens — exposes risk scores via REST API and a free sanctions-only endpoint.
- 01wallet risk scoring
- 02sanctions wallet screening
- 03transaction monitoring
- 04MiCA / TFR self-hosted wallet checks
- 05graph-based fund tracing
| Variable | Scope | Description |
|---|---|---|
| SCORECHAIN_API_KEY | Server | API key from the Scorechain dashboard for the Risk Assessment API. |
Use Scorechain to risk-score destination wallets before withdrawals and to screen incoming deposits. Server-side, call `GET https://api.scorechain.com/v1/scoringAnalysis/{coin}/{address}` with `X-API-KEY: <SCORECHAIN_API_KEY>` (`coin` = `bitcoin`, `ethereum`, `tron`, `solana`, etc.) — the response returns a `score` (0–100), `severity` (LOW/MEDIUM/HIGH/SEVERE), and `assignedCategory` plus exposure breakdowns. For transaction-level checks, call `GET /v1/transactionAnalysis/{coin}/{txHash}` to grade the tx. To enforce ongoing monitoring, register the address via `POST /v1/monitoring/addresses` and consume the alerts webhook. Use the free Sanctions API (`/v1/sanctions/{coin}/{address}`) as a low-cost first line for OFAC/UN/EU sanctioned wallet checks before paying for the full risk score.
- ⚑Risk scores are exposure-weighted — a wallet one hop from a known bad actor can score HIGH even if direct activity is benign. Document your hop-distance and severity policy and stick to it.
- ⚑Token coverage is broad but not exhaustive — for long-tail ERC-20/SPL tokens you may get scores on the address without per-token exposure, which is fine for sanctions but weak for category-level monitoring.
- ⚑Jurisdictional sanctions lists differ (OFAC vs UN vs EU vs UK HMT) — request the lists you're regulated against and avoid building your own union, otherwise you may over- or under-block.
- ⚑False positives spike on protocol-owned addresses (DEX routers, bridges, CEX hot wallets) — maintain an allowlist of known infra contracts so your reviewer queue stays signal-rich.
- ⚑Sandbox/test data is static and does not reflect live attribution — never tune thresholds against sandbox.
- ⚑Webhook deliveries are signed via HMAC in the `X-Scorechain-Signature` header — verify on every call.
- ⚑Data retention for screening events is contract-defined; persist raw API responses on your side for AMLD/FinCEN record-keeping.